[NCC-E005955-HV6] zebra-network: Buffer length validation after memory allocation

[mpguerra]

Motivation

We want to track all of the findings from the zebra audit.

Details

When deserializing a version 2 address, the length of the (variable-length) address is validated after the address is read into a buffer. An unexpectedly large address can temporarily lead to a large memory allocation on the heap. It is recommended to peek at the length of the address and validate it before reading the addr:

zebra/zebra-network/src/protocol/external/addr/v2.rs

Lines 285 to 296 in 5a88fe7

	// > CompactSize The length in bytes of addr.
	// > uint8[sizeAddr] Network address. The interpretation depends on networkID.
	let addr: Vec<u8> = (&mut reader).zcash_deserialize_into()?;
	// > uint16 Network port. If not relevant for the network this MUST be 0.
	let port = reader.read_u16::<BigEndian>()?;
	if addr.len() > MAX_ADDR_V2_ADDR_SIZE {
	return Err(SerializationError::Parse(
	"addr field longer than MAX_ADDR_V2_ADDR_SIZE in addrv2 message",
	));
	}

Note that the deserialization logic ensures that the length of the addr vector is smaller than MAX_U8_ALLOCATION (currently 2097147 bytes) which is significantly higher than MAX_ADDR_V2_ADDR_SIZE (currently set to 512).

[mpguerra]

Hey team! Please add your planning poker estimate with Zenhub @arya2 @conradoplg @dconnolly @oxarbitrage @teor2345 @upbqdn